chore(deps): bump the cargo-major group with 26 updates by dependabot[bot] · Pull Request #4113 · 514-labs/moosestack

dependabot · 2026-06-06T03:07:35Z

Bumps the cargo-major group with 26 updates:

Package	From	To
itertools	`0.13.0`	`0.14.0`
thiserror	`1.0.69`	`2.0.17`
toml	`0.5.11`	`0.9.8`
config	`0.13.4`	`0.15.19`
clickhouse	`0.14.1`	`0.14.3`
handlebars	`5.1.2`	`6.4.1`
rdkafka	`0.38.0`	`0.39.0`
convert_case	`0.6.0`	`0.11.0`
git2	`0.18.3`	`0.21.0`
reqwest	`0.11.27`	`0.13.2`
toml_edit	`0.22.27`	`0.23.7`
rustpython-parser	`0.3.1`	`0.4.0`
rustpython-ast	`0.3.1`	`0.4.0`
ratatui	`0.27.0`	`0.29.0`
crossterm	`0.27.0`	`0.29.0`
sha2	`0.10.9`	`0.11.0`
constant_time_eq	`0.3.1`	`0.5.0`
redis	`0.29.5`	`1.2.2`
jsonwebtoken	`9.3.1`	`10.4.0`
logos	`0.15.1`	`0.16.1`
prometheus-client	`0.23.1`	`0.24.1`
prost-types	`0.13.5`	`0.14.3`
prost-wkt-types	`0.6.1`	`0.7.1`
rmcp	`0.16.0`	`1.7.0`
toon-format	`0.4.0`	`0.5.0`
kafka-protocol	`0.16.0`	`0.17.0`

Updates itertools from 0.13.0 to 0.14.0

Changelog

Sourced from itertools's changelog.

0.14.0

Breaking

Increased MSRV to 1.63.0 (#960)

Removed generic parameter from cons_tuples (#988)

Added

Added array_combinations (#991)

Added k_smallest_relaxed and variants (#925)

Added next_array and collect_array (#560)

Implemented DoubleEndedIterator for FilterOk (#948)

Implemented DoubleEndedIterator for FilterMapOk (#950)

Changed

Allow Q: ?Sized in Itertools::contains (#971)

Improved hygiene of chain! (#943)

Improved into_group_map_by documentation (#1000)

Improved tree_reduce documentation (#955)

Improved discoverability of merge_join_by (#966)

Improved discoverability of take_while_inclusive (#972)

Improved documentation of find_or_last and find_or_first (#984)

Prevented exponentially large type sizes in tuple_combinations (#945)

Added track_caller attr for asser_equal (#976)

Notable Internal Changes

Fixed clippy lints (#956, #987, #1008)

Addressed warnings within doctests (#964)

CI: Run most tests with miri (#961)

CI: Speed up "cargo-semver-checks" action (#938)

Changed an instance of default_features in Cargo.toml to default-features (#985)

Commits

a015a68 Add next_array and collect_array
a1213e1 Prepare v0.14.0 release
ff0c942 fix clippy lints
f80883b Fix into_group_map_by documentation errors
b793238 Add track_caller for asser_equal
5d4056b default_features is deprecated - switch it to default-features
a447b68 doc for added trait
d0479b0 "nitpicks"
35c78ce IndexMut -> BorrowMut<slice>
deb53ba refactored to share code
Additional commits viewable in compare view

Updates thiserror from 1.0.69 to 2.0.17

Release notes

Sourced from thiserror's releases.

2.0.17

Use differently named __private module per patch release (#434)

2.0.16

Add to "no-std" crates.io category (#429)

2.0.15

Prevent Error::provide API becoming unavailable from a future new compiler lint (#427)

2.0.14

Allow build-script cleanup failure with NFSv3 output directory to be non-fatal (#426)

2.0.13

Documentation improvements

2.0.12

Prevent elidable_lifetime_names pedantic clippy lint in generated impl (#413)

2.0.11

Add feature gate to tests that use std (#409, #410, thanks @Maytha8)

2.0.10

Support errors containing a generic type parameter's associated type in a field (#408)

2.0.9

Work around missing_inline_in_public_items clippy restriction being triggered in macro-generated code (#404)

2.0.8

Improve support for macro-generated derive(Error) call sites (#399)

2.0.7

Work around conflict with #[deny(clippy::allow_attributes)] (#397, thanks @zertosh)

2.0.6

Suppress deprecation warning on generated From impls (#396)

2.0.5

Prevent deprecation warning on generated impl for deprecated type (#394)

2.0.4

Eliminate needless_lifetimes clippy lint in generated From impls (#391, thanks @matt-phylum)

2.0.3

Support the same Path field being repeated in both Debug and Display representation in error message (#383)

Improve error message when a format trait used in error message is not implemented by some field (#384)

2.0.2

Fix hang on invalid input inside #[error(...)] attribute (#382)

2.0.1

... (truncated)

Commits

72ae716 Release 2.0.17
599fdce Merge pull request #434 from dtolnay/private
9ec05f6 Use differently named __private module per patch release
d2c492b Raise minimum tested compiler to rust 1.76
fc3ab95 Opt in to generate-macro-expansion when building on docs.rs
819fe29 Update ui test suite to nightly-2025-09-12
259f48c Enforce trybuild >= 1.0.108
470e6a6 Update ui test suite to nightly-2025-08-24
544e191 Update actions/checkout@v4 -> v5
cbc1eba Delete duplicate cap-lints flag from build script
Additional commits viewable in compare view

Updates toml from 0.5.11 to 0.9.8

Commits

93e9146 chore: Release
7de1b4e docs: Update changelog
1b579c3 feat(serde): Support integer, bools, and chars as keys (#1050)
ac1e077 feat(serde): Support chars as keys
f3dec32 feat(serde): Support bools as keys
139b30a feat(serde): Support integer keys
2d65a88 test(serde): Show existing key behavior
80217f8 chore(deps): Update actions/checkout action to v5 (#1047)
b36e351 chore(deps): Update actions/checkout action to v5
7d2c649 chore(deps): Update actions/setup-python action to v6 (#1048)
Additional commits viewable in compare view

Updates config from 0.13.4 to 0.15.19

Changelog

Sourced from config's changelog.

[0.15.19] - 2025-11-12

Internal

(ron) Update to 0.12

[0.15.18] - 2025-09-30

Fixes

Improve consistency between missing field error messages

[0.15.17] - 2025-09-24

Features

corn file format support

[0.15.16] - 2025-09-15

Performance

Allow more build parallelism by depending on serde_core

[0.15.15] - 2025-08-29

Fixes

(json5) Correctly deserialize null (regressed in 0.15.14)

[0.15.14] - 2025-08-12

Performance

(json5) Reduce overhead when loading json5 files

[0.15.13] - 2025-07-09

Fixes

Skip UTF-8 BOMs when reading files

[0.15.12] - 2025-07-08

Performance

Upgrade to toml v0.9

[0.15.11] - 2025-03-12

... (truncated)

Commits

e7ff326 chore: Release config version 0.15.19
cbee54c chore: Update deps (#715)
d53e906 chore: Update deps
b10653a docs: Update changelog
527de7d fix: Update to latest ron (#714)
6c2cfd0 fix: Update to latest ron
16ef680 chore(deps): Update Rust Stable to v1.91 (#712)
2051f62 style: Make clippy happy
bf6e256 chore: Update dependencies (#702)
de242e0 chore: Update dependencies
Additional commits viewable in compare view

Updates clickhouse from 0.14.1 to 0.14.3

Changelog

Sourced from clickhouse's changelog.

[0.14.3] - 2026-03-27

Added

Added support for SimpleAggregateFunction type (#394)

Fixed

Fixed serialization of Option::None with Query::param() (#385)

Fixed handling of Json type with type hints (#387)

Fixed Insert for temporary tables and qualified table names (#391)

Updated lz4_flex to get fix for [RUSTSEC-2026-0041] (#396)

#385: ClickHouse/clickhouse-rs#385 #387: ClickHouse/clickhouse-rs#387 #391: ClickHouse/clickhouse-rs#391 #394: ClickHouse/clickhouse-rs#394 #396: ClickHouse/clickhouse-rs#396 [RUSTSEC-2026-0041]: https://rustsec.org/advisories/RUSTSEC-2026-0041

[0.14.2] - 2026-01-14

Added

Added Client::insert_formatted_with() and InsertFormatted for inserting data in a chosen format with a specified SQL query. (#364)

InsertFormatted does not buffer data by default, allowing precise control over when the data is sent. For best performance, ensure data is sent in larger chunks or use .buffered() to get BufInsertFormatted which implements buffering.

Data may optionally be pre-compressed and buffered separately using CompressedData::new() and InsertFormatted::send_compressed().

BufInsertFormatted also implements tokio::io::AsyncWrite for composability.

Added Client::set_option to modify options through &mut Client (#375)

Added Client::get_option to read previously set options (#375)

Added support for binding byte-strings as server-side params (#376)

This means passing types to Query::param that call Serializer::serialize_bytes() are now supported.

Note that Vec<u8> and &[u8] serialize as an array of integers. Use a specialized type, e.g. bytes::Bytes or serde_bytes::Bytes to bind a byte-string.

Implemented Primitive for bytes::Bytes and bytes::BytesMut (#376)

These can be used to fetch byte-strings as a scalar value, e.g. with Query::fetch_one().

Fixed

Implemented parsing for the new exception tagging format in ClickHouse 25.11 (#365)

Fixed a doc comment on clickhouse::serde::chrono::date (#371)

Changed

(CI-only change) added scheduled runs against clickhouse-server:head tag, reworked secrets access (#367)

Query no longer sets [the readonly option] by default. (#377)

This was previously added in #342 to simulate the default read-only restriction when issuing queries via GET requests, but had poor interaction with settings profiles that set readonly="2".

#364: ClickHouse/clickhouse-rs#364

... (truncated)

Commits

4503afb feat: release 0.14.3 (#402)
ae38da2 Update lz4_flex due to buffer overflow (#396)
7d03c61 fix(types): add SimpleAggregateFunction support to type parser (#394)
32bed3d fix Insert for temporary and qualified tables (#391)
8323e7f 382 cannot insert new json values if column def has type hints (#387)
cc27477 add codeowners (#381)
73438b2 serializes to \N instead of NULL (#385)
5fddaaa Release 0.14.2 (#378)
f1d97fb refactor: don't set readonly by default (#377)
63f3f2e feat: support byte-string params, implement Primitive for `bytes::Bytes{Mut...
Additional commits viewable in compare view

Updates handlebars from 5.1.2 to 6.4.1

Release notes

Sourced from handlebars's releases.

v6.4.0

What's Changed

fix: allow colons in identifier by @sunng87 in sunng87/handlebars-rust#706

docs: remove incorrect parameters from docstring by @vsbits in sunng87/handlebars-rust#707

chore(deps-dev): bump http-proxy-middleware from 2.0.7 to 2.0.9 in /playground/www by @dependabot[bot] in sunng87/handlebars-rust#709

expose DirectorySourceOptionsBuilder & added doc example by @markwellis in sunng87/handlebars-rust#710

chore(deps): update pprof requirement from 0.14 to 0.15 by @dependabot[bot] in sunng87/handlebars-rust#714

chore(deps-dev): bump webpack-dev-server from 5.1.0 to 5.2.1 in /playground/www by @dependabot[bot] in sunng87/handlebars-rust#715

chore(deps): update criterion requirement from 0.5 to 0.6 by @dependabot[bot] in sunng87/handlebars-rust#712

feat: Added dynamic partial blocks by adding support for empty block closing tags by @henriquecolini in sunng87/handlebars-rust#713

feat: Export WriteOutput in public API by @SuchAFuriousDeath in sunng87/handlebars-rust#717

chore(deps): bump on-headers and compression in /playground/www by @dependabot[bot] in sunng87/handlebars-rust#718

chore(deps): update criterion requirement from 0.6 to 0.7 by @dependabot[bot] in sunng87/handlebars-rust#719

feat: else support for boolean helpers by @exoego in sunng87/handlebars-rust#720

Fix the build with -Zminimal-versions by @ppentchev in sunng87/handlebars-rust#723

Add Ability to Unregister Helpers by @Lepidopteran in sunng87/handlebars-rust#725

chore(deps-dev): bump node-forge from 1.3.1 to 1.3.2 in /playground/www by @dependabot[bot] in sunng87/handlebars-rust#727

Option to enable recursive resolution of variables by @wez in sunng87/handlebars-rust#730

chore(deps): update criterion requirement from 0.7 to 0.8 by @dependabot[bot] in sunng87/handlebars-rust#728

chore(deps): bump qs and express in /playground/www by @dependabot[bot] in sunng87/handlebars-rust#731

fix: correct partial-block render by @sunng87 in sunng87/handlebars-rust#732

New Contributors

@vsbits made their first contribution in sunng87/handlebars-rust#707

@markwellis made their first contribution in sunng87/handlebars-rust#710

@henriquecolini made their first contribution in sunng87/handlebars-rust#713

@SuchAFuriousDeath made their first contribution in sunng87/handlebars-rust#717

@exoego made their first contribution in sunng87/handlebars-rust#720

@ppentchev made their first contribution in sunng87/handlebars-rust#723

@Lepidopteran made their first contribution in sunng87/handlebars-rust#725

@wez made their first contribution in sunng87/handlebars-rust#730

Full Changelog: sunng87/handlebars-rust@v6.3.2...v6.4.0

v6.3.2

What's Changed

fix: partial context with literal parameters by @sunng87 in sunng87/handlebars-rust#695

feat: correct implementation of partial block by @sunng87 in sunng87/handlebars-rust#699

Full Changelog: sunng87/handlebars-rust@v6.3.1...v6.3.2

v6.3.1

What's Changed

Fix documentation typo by @Flamenco in sunng87/handlebars-rust#690

fix: reimplement partial context as block params by @sunng87 in sunng87/handlebars-rust#694

New Contributors

@Flamenco made their first contribution in sunng87/handlebars-rust#690

... (truncated)

Changelog

Sourced from handlebars's changelog.

6.4.1 - 2026-05-16

[Fixed] Allow using @partial-block with block include and fallback template #752

6.4.0 - 2026-01-02

[Fixed] Reimplement partial-block, fixed partial-block resolution issues #732

[Added] recursive_lookup mode #730

6.3.2 - 2025-03-16

[Fixed] Reimplementation of partial context #699

6.3.1 - 2025-02-09

[Fixed] Regression of partial context #694

6.3.0 - 2025-01-05

[Added] Builders for some non-exhaustive structs #688

[Changed] and and or helper now accepts multiple parameters #687

[Changed] MSRV is now 1.73

6.2.0 - 2024-10-26

[Added] @index variable for object iteration #682

[Changed] improve number comparison between different types #679

6.1.0 - 2024-09-06

[Added] More data type support in comparison helpers #673

6.0.0 - 2024-07-20

[Fixed] Various indent issue with partials, empty lines and helpers #646 #654 #658

[Fixed] Bug when accessing nested path #651

[Added] New public access to PathSeg #656

[Added] New API to set single block params in BlockContext #655

[Added] From<RenderError> for RenderErrorReason #644

[Changed] Add non_exhaustive attribute to all public memebers #647

[Changed] RenderContext API and improved performance for partial rendering #661 #662

[Changed] Improved error messsage for template parsing #638

Commits

ca12e80 chore: Release handlebars version 6.4.1
d536a83 chore: housekeeping changelog
2e398f3 fix: allow block include for partial-block (#752)
935577b chore: remove built-in cli (#750)
ef5b45e chore(deps-dev): bump serialize-javascript in /playground/www (#751)
bfed66a chore(deps-dev): bump fast-uri from 3.0.3 to 3.1.2 in /playground/www (#749)
6f92bc7 chore(deps-dev): bump follow-redirects in /playground/www (#748)
059be2f chore: correct fmt
c99c1d5 chore: update docs string example #744
3382a5e chore(deps-dev): bump node-forge from 1.3.2 to 1.4.0 in /playground/www (#746)
Additional commits viewable in compare view

Updates rdkafka from 0.38.0 to 0.39.0

Changelog

Sourced from rdkafka's changelog.

0.39.0 (2026-01-25)

Fix the char zero ending in native config (#706).

Implement FromIterator for TopicPartitionList (#795).

Sanitize ClientConfig and AdminClient debugging (#796).

Handle null characters in topic in BaseProducer::send (#782).

Bump rdkafka-sys.

#706: fede1024/rust-rdkafka#706 #795: fede1024/rust-rdkafka#795 #796: fede1024/rust-rdkafka#796 #782: fede1024/rust-rdkafka#782

Commits

See full diff in compare view

Updates convert_case from 0.6.0 to 0.11.0

Commits

See full diff in compare view

Updates git2 from 0.18.3 to 0.21.0

Changelog

Sourced from git2's changelog.

0.21.0 - 2026-05-18

0.20.4...main

Added

Added experimental SHA256 repository support behind the new unstable-sha256 Cargo feature, along with *_ext API variants that accept an ObjectFormat. #1206

Added opts::set_cache_max_size() and opts::get_cached_memory(). #1188

Added Repository::object_format() and a new ObjectFormat enum. #1204

Added Repository::set_config(). #1208

Added merge_file() along with MergeFileInput. #1210

Added Repository::refdb_compress() for packing loose refs. #1221

Added public Refdb type, along with Repository::refdb() and Repository::set_refdb(). Repository::refdb_compress() now delegates to Refdb::compress(). #1228

Added Revspec::into_objects(). #1230

Added BlameHunk::final_committer(), BlameHunk::orig_committer(), BlameHunk::summary(), and BlameHunk::summary_bytes(). #1231

Implemented Clone for Reference. #1233

Added Repository::author_from_env() and Repository::committer_from_env(). #1237

Added impl From<Utf8Error> for Error. #1239

Changed

❗ The ssh, https, and cred Cargo features are no longer enabled by default. Previously default = ["ssh", "https"]; now default = []. Enable them explicitly if you rely on credential helpers or transport support. #1168

❗ CredentialHelper and the url dependency are now gated behind the new cred Cargo feature. Enabling ssh or https transitively enables cred. #1168

❗ Updated to the 2021 edition. #1173

❗ Many string accessors that previously returned Option<&str> now return Result<&str, Error> or Result<Option<&str>, Error>, so callers can distinguish a missing value from a non-UTF-8 one. #1241

❗ BlameHunk::final_signature, BlameHunk::final_committer, BlameHunk::orig_signature, and BlameHunk::orig_committer now return Option to avoid segfaults when signature information is missing. #1254

Bumped requirement to libgit2-sys 0.18.4, which updates libgit2 to 1.9.3.

... (truncated)

Commits

dffaf27 Merge pull request #1256 from weihanglo/changelog
84b9c76 docs: changelog for git2@0.21
8c6dc4a Merge pull request #1206 from weihanglo/sha256-git2
7bd145e fix: import ObjectFormat in one place
fc8af6a test(oid): split _ext to test each format separately
b9bde87 test: oid length sanity check
57a68e0 feat(oid): impl Display for ObjectFormat
7acee09 chore(ci): test git2 sha256 support
bdf5b7b fix: init example with --object-format option
9fb4e6a refactor(util): drop unsafe from zeroed_raw_oid
Additional commits viewable in compare view

Updates reqwest from 0.11.27 to 0.13.2

Release notes

Sourced from reqwest's releases.

v0.13.2

tl;dr

Fix HTTP/2 and native-tls ALPN feature combinations.

Fix HTTP/3 to send h3 ALPN.

(wasm) fix RequestBuilder::json() from override previously set content-type.

What's Changed

chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in seanmonstar/reqwest#2921

Update readme for 0.13 by @VojtaStanek in seanmonstar/reqwest#2926

fix http2 feature is not enabled for "native-tls" by @fox0 in seanmonstar/reqwest#2927

chore(deps): remove unused webpki-roots and rustls-native-certs by @seanmonstar in seanmonstar/reqwest#2932

docs: native-tls-alpn has changed to native-tls-no-alpn by @seanmonstar in seanmonstar/reqwest#2940

Specify h3 alpn for http3 connector by @passcod in seanmonstar/reqwest#2929

update copyright year to 2026 by @taozui472 in seanmonstar/reqwest#2943

fix(json): custom content-type overidden by json method for wasm by @Narendran-KT in seanmonstar/reqwest#2908

chore: upgrade wasm-streams to v0.5 by @xangelix in seanmonstar/reqwest#2958

chore(ci): add windows and linux arm64 to ci by @dennisameling in seanmonstar/reqwest#2960

New Contributors

@VojtaStanek made their first contribution in seanmonstar/reqwest#2926

@fox0 made their first contribution in seanmonstar/reqwest#2927

@passcod made their first contribution in seanmonstar/reqwest#2929

@taozui472 made their first contribution in seanmonstar/reqwest#2943

@Narendran-KT made their first contribution in seanmonstar/reqwest#2908

@xangelix made their first contribution in seanmonstar/reqwest#2958

@dennisameling made their first contribution in seanmonstar/reqwest#2960

Full Changelog: seanmonstar/reqwest@v0.13.1...v0.13.2

v0.13.1

What's Changed

http3: depend on quinn/rustls-aws-lc-rs to avoid ring dependency by @djc in seanmonstar/reqwest#2917

fix rustls on android by @seanmonstar in seanmonstar/reqwest#2918

Full Changelog: seanmonstar/reqwest@v0.13.0...v0.13.1

v0.13.0

Breaking changes

rustls is now the default TLS backend, instead of native-tls.

rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)

rustls-tls has been renamed to rustls.

rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).

native-tls now includes ALPN. To disable, use native-tls-no-alpn.

query and form are now crate features, disabled by default.

Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.2

Fix HTTP/2 and native-tls ALPN feature combinations.

Fix HTTP/3 to send h3 ALPN.

(wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

Fixes compiling with rustls on Android targets.

v0.13.0

Breaking changes:

rustls is now the default TLS backend, instead of native-tls.

rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)

rustls-tls has been renamed to rustls.

rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).

native-tls now includes ALPN. To disable, use native-tls-no-alpn.

query and form are now crate features, disabled by default.

Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).

Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)

For example, prefer tls_backend_rustls() over use_rustls_tls().

v0.12.28

Fix compiling on Windows if TLS and SOCKS features are not enabled.

v0.12.27

Add ClientBuilder::windows_named_pipe(name) option that will force all requests over that Windows Named Piper.

v0.12.26

Fix sending Accept-Encoding header only with values configured with reqwest, regardless of underlying tower-http config.

v0.12.25

Add Error::is_upgrade() to determine if the error was from an HTTP upgrade.

Fix sending Proxy-Authorization if only username is configured.

Fix sending Proxy-Authorization to HTTPS proxies when the target is HTTP.

Refactor internal decompression handling to use tower-http.

v0.12.24

Refactor cookie handling to an internal middleware.

Refactor internal random generator.

Refactor base64 encoding to reduce a copy.

Documentation updates.

... (truncated)

Commits

ad83b63 v0.13.2
c25f3db chore: Add Windows and Linux arm64 to CI (#2960)
761b89e chore: upgrade wasm-streams to v0.5 (#2958)
fd2d507 fix(wasm): custom content-type overidden by json method for wasm (#2908)
10c31c2 fix(http3): specify h3 alpn for http3 connector (#2929)
8530ec3 docs: native-tls-alpn has changed to native-tls-no-alpn (#2940)
04a216f chore(deps): remove unused webpki-roots and rustls-native-certs (#2932)
406b59e fix http2 feature is not enabled for native-tls ALPN (#2927)
325a020 Update readme for 0.13 (#2926)
Additional commits viewable in compare view

Updates toml_edit from 0.22.27 to 0.23.7

Commits

93e9146 chore: Release
7de1b4e docs: Update changelog
1b579c3 feat(serde): Support integer, bools, and chars as keys (#1050)
ac1e077 feat(serde): Support chars as keys
f3dec32 feat(serde): Support bools as keys
139b30a feat(serde): Support integer keys
2d65a88 test(serde): Show existing key behavior
80217f8 chore(deps): Update actions/checkout action to v5 (#1047)
b36e351 chore(deps): Update actions/checkout action to v5
7d2c649 chore(deps): Update actions/setup-python action to v6 (#1048)
Additional commits viewable in compare view

Updates rustpython-parser from 0.3.1 to 0.4.0

Commits

8dd2aea mark 0.4.0
00d2f1d fix formatting issues
50638bd change function name
cfb9c93 add underline handling to float parsing
... Description has been truncated[!NOTE] Medium Risk Large semver jumps touch auth (jsonwebtoken), Redis, HTTP (reqwest), git integration, and protobuf/MCP stacks without accompanying code fixes in this diff; compile/test coverage is the main gate. Overview Bumps 26 major/minor Rust dependencies across moose-cli (apps/framework-cli), devkafka, devredis, and posthog514client-rs, with a matching Cargo.lock refresh (including transitive changes such as reqwest 0.13’s QUIC/rustls stack and config’s move to toml 0.9 / yaml-rust2). Notable version jumps in the CLI crate include redis 1.x, jsonwebtoken 10, git2 0.21, handlebars 6, prost-types / prost-wkt-types 0.14/0.7, rmcp 1.7, ratatui 0.29, thiserror 2, and kafka-protocol 0.17 in dev tools. There are no application .rs changes in the diff—only manifest and lockfile updates. ^{Reviewed by}Cursor Bugbot for commit 12869c0f19f34be54c9665ce2bbc5a8d8da5d1d6. Bugbot is set up for automated code reviews on this repo. Configure here.

Bumps the cargo-major group with 26 updates: | Package | From | To | | --- | --- | --- | | [itertools](https://github.com/rust-itertools/itertools) | `0.13.0` | `0.14.0` | | [thiserror](https://github.com/dtolnay/thiserror) | `1.0.69` | `2.0.17` | | [toml](https://github.com/toml-rs/toml) | `0.5.11` | `0.9.8` | | [config](https://github.com/rust-cli/config-rs) | `0.13.4` | `0.15.19` | | [clickhouse](https://github.com/ClickHouse/clickhouse-rs) | `0.14.1` | `0.14.3` | | [handlebars](https://github.com/sunng87/handlebars-rust) | `5.1.2` | `6.4.1` | | [rdkafka](https://github.com/fede1024/rust-rdkafka) | `0.38.0` | `0.39.0` | | [convert_case](https://github.com/rutrum/convert-case) | `0.6.0` | `0.11.0` | | [git2](https://github.com/rust-lang/git2-rs) | `0.18.3` | `0.21.0` | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.11.27` | `0.13.2` | | [toml_edit](https://github.com/toml-rs/toml) | `0.22.27` | `0.23.7` | | [rustpython-parser](https://github.com/RustPython/Parser) | `0.3.1` | `0.4.0` | | [rustpython-ast](https://github.com/RustPython/Parser) | `0.3.1` | `0.4.0` | | [ratatui](https://github.com/ratatui/ratatui) | `0.27.0` | `0.29.0` | | [crossterm](https://github.com/crossterm-rs/crossterm) | `0.27.0` | `0.29.0` | | [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` | | [constant_time_eq](https://github.com/cesarb/constant_time_eq) | `0.3.1` | `0.5.0` | | [redis](https://github.com/redis-rs/redis-rs) | `0.29.5` | `1.2.2` | | [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `9.3.1` | `10.4.0` | | [logos](https://github.com/maciejhirsz/logos) | `0.15.1` | `0.16.1` | | [prometheus-client](https://github.com/prometheus/client_rust) | `0.23.1` | `0.24.1` | | [prost-types](https://github.com/tokio-rs/prost) | `0.13.5` | `0.14.3` | | [prost-wkt-types](https://github.com/fdeantoni/prost-wkt) | `0.6.1` | `0.7.1` | | [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `0.16.0` | `1.7.0` | | [toon-format](https://github.com/toon-format/toon-rust) | `0.4.0` | `0.5.0` | | [kafka-protocol](https://github.com/tychedelia/kafka-protocol-rs) | `0.16.0` | `0.17.0` | Updates `itertools` from 0.13.0 to 0.14.0 - [Changelog](https://github.com/rust-itertools/itertools/blob/master/CHANGELOG.md) - [Commits](rust-itertools/itertools@v0.13.0...v0.14.0) Updates `thiserror` from 1.0.69 to 2.0.17 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@1.0.69...2.0.17) Updates `toml` from 0.5.11 to 0.9.8 - [Commits](toml-rs/toml@toml-v0.5.11...toml-v0.9.8) Updates `config` from 0.13.4 to 0.15.19 - [Changelog](https://github.com/rust-cli/config-rs/blob/main/CHANGELOG.md) - [Commits](rust-cli/config-rs@v0.13.4...v0.15.19) Updates `clickhouse` from 0.14.1 to 0.14.3 - [Changelog](https://github.com/ClickHouse/clickhouse-rs/blob/main/CHANGELOG.md) - [Commits](ClickHouse/clickhouse-rs@v0.14.1...v0.14.3) Updates `handlebars` from 5.1.2 to 6.4.1 - [Release notes](https://github.com/sunng87/handlebars-rust/releases) - [Changelog](https://github.com/sunng87/handlebars-rust/blob/master/CHANGELOG.md) - [Commits](sunng87/handlebars-rust@v5.1.2...v6.4.1) Updates `rdkafka` from 0.38.0 to 0.39.0 - [Changelog](https://github.com/fede1024/rust-rdkafka/blob/master/changelog.md) - [Commits](https://github.com/fede1024/rust-rdkafka/commits/v0.39.0) Updates `convert_case` from 0.6.0 to 0.11.0 - [Commits](https://github.com/rutrum/convert-case/commits) Updates `git2` from 0.18.3 to 0.21.0 - [Changelog](https://github.com/rust-lang/git2-rs/blob/main/CHANGELOG.md) - [Commits](rust-lang/git2-rs@git2-0.18.3...git2-0.21.0) Updates `reqwest` from 0.11.27 to 0.13.2 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.11.27...v0.13.2) Updates `toml_edit` from 0.22.27 to 0.23.7 - [Commits](toml-rs/toml@v0.22.27...v0.23.7) Updates `rustpython-parser` from 0.3.1 to 0.4.0 - [Commits](RustPython/Parser@0.3.1...0.4.0) Updates `rustpython-ast` from 0.3.1 to 0.4.0 - [Commits](RustPython/Parser@0.3.1...0.4.0) Updates `ratatui` from 0.27.0 to 0.29.0 - [Release notes](https://github.com/ratatui/ratatui/releases) - [Changelog](https://github.com/ratatui/ratatui/blob/main/CHANGELOG.md) - [Commits](ratatui/ratatui@v0.27.0...v0.29.0) Updates `crossterm` from 0.27.0 to 0.29.0 - [Release notes](https://github.com/crossterm-rs/crossterm/releases) - [Changelog](https://github.com/crossterm-rs/crossterm/blob/master/CHANGELOG.md) - [Commits](crossterm-rs/crossterm@0.27.0...0.29) Updates `sha2` from 0.10.9 to 0.11.0 - [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0) Updates `constant_time_eq` from 0.3.1 to 0.5.0 - [Changelog](https://github.com/cesarb/constant_time_eq/blob/main/CHANGES) - [Commits](cesarb/constant_time_eq@0.3.1...0.5.0) Updates `redis` from 0.29.5 to 1.2.2 - [Release notes](https://github.com/redis-rs/redis-rs/releases) - [Commits](redis-rs/redis-rs@redis-0.29.5...redis-1.2.2) Updates `jsonwebtoken` from 9.3.1 to 10.4.0 - [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](Keats/jsonwebtoken@v9.3.1...v10.4.0) Updates `logos` from 0.15.1 to 0.16.1 - [Release notes](https://github.com/maciejhirsz/logos/releases) - [Changelog](https://github.com/maciejhirsz/logos/blob/master/RELEASE-PROCESS.md) - [Commits](maciejhirsz/logos@v0.15.1...v0.16.1) Updates `prometheus-client` from 0.23.1 to 0.24.1 - [Release notes](https://github.com/prometheus/client_rust/releases) - [Changelog](https://github.com/prometheus/client_rust/blob/master/CHANGELOG.md) - [Commits](prometheus/client_rust@v0.23.1...v0.24.1) Updates `prost-types` from 0.13.5 to 0.14.3 - [Release notes](https://github.com/tokio-rs/prost/releases) - [Changelog](https://github.com/tokio-rs/prost/blob/master/CHANGELOG.md) - [Commits](tokio-rs/prost@v0.13.5...v0.14.3) Updates `prost-wkt-types` from 0.6.1 to 0.7.1 - [Release notes](https://github.com/fdeantoni/prost-wkt/releases) - [Changelog](https://github.com/fdeantoni/prost-wkt/blob/master/CHANGELOG.md) - [Commits](fdeantoni/prost-wkt@v0.6.1...v0.7.1) Updates `rmcp` from 0.16.0 to 1.7.0 - [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml) - [Commits](modelcontextprotocol/rust-sdk@rmcp-v0.16.0...rmcp-v1.7.0) Updates `toon-format` from 0.4.0 to 0.5.0 - [Release notes](https://github.com/toon-format/toon-rust/releases) - [Changelog](https://github.com/toon-format/toon-rust/blob/main/CHANGELOG.md) - [Commits](toon-format/toon-rust@v0.4.0...v0.5.0) Updates `kafka-protocol` from 0.16.0 to 0.17.0 - [Release notes](https://github.com/tychedelia/kafka-protocol-rs/releases) - [Changelog](https://github.com/tychedelia/kafka-protocol-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/tychedelia/kafka-protocol-rs/commits) --- updated-dependencies: - dependency-name: itertools dependency-version: 0.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: thiserror dependency-version: 2.0.17 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-major - dependency-name: toml dependency-version: 0.9.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: config dependency-version: 0.15.19 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: clickhouse dependency-version: 0.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-major - dependency-name: handlebars dependency-version: 6.4.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-major - dependency-name: rdkafka dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: convert_case dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: git2 dependency-version: 0.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: reqwest dependency-version: 0.13.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: toml_edit dependency-version: 0.23.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: rustpython-parser dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: rustpython-ast dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: ratatui dependency-version: 0.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: crossterm dependency-version: 0.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: sha2 dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: constant_time_eq dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: redis dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-major - dependency-name: jsonwebtoken dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-major - dependency-name: logos dependency-version: 0.16.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: prometheus-client dependency-version: 0.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: prost-types dependency-version: 0.14.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: prost-wkt-types dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: rmcp dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-major - dependency-name: toon-format dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: kafka-protocol dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-06-06T03:07:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Ready	Preview, Comment	Jun 6, 2026 3:09am

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12869c0. Configure here.}

cursor · 2026-06-06T03:09:03Z


 [dependencies]
-reqwest = { version = "0.11", features = ["json"] }
+reqwest = { version = "0.13", features = ["json"] }


PostHog TLS stack mismatch

Medium Severity

Upgrading reqwest to 0.13 in the PostHog client keeps only the json feature, so the client follows reqwest’s new default TLS stack (rustls with platform verification) instead of the native-tls path used elsewhere in moose-cli. Telemetry HTTPS calls can fail or behave differently in environments where OpenSSL/native-tls worked before but the rustls verifier does not.

^{Reviewed by Cursor Bugbot for commit 12869c0. Configure here.}

dependabot · 2026-06-10T19:38:54Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Jun 6, 2026

cursor Bot reviewed Jun 6, 2026

View reviewed changes

vercel Bot deployed to Preview June 6, 2026 03:09 View deployment

callicles closed this Jun 10, 2026

dependabot Bot deleted the dependabot/cargo/cargo-major-e3b2f5c5ec branch June 10, 2026 19:39

Navigation Menu

Uh oh!

chore(deps): bump the cargo-major group with 26 updates - #4113

chore(deps): bump the cargo-major group with 26 updates#4113
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-major-e3b2f5c5ec

dependabot Bot commented on behalf of github Jun 6, 2026 •

edited by cursor Bot

Loading

Uh oh!

vercel Bot commented Jun 6, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jun 6, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 6, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.14.0

Breaking

Added

Changed

Notable Internal Changes

2.0.17

2.0.16

2.0.15

2.0.14

2.0.13

2.0.12

2.0.11

2.0.10

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

[0.15.19] - 2025-11-12

Internal

[0.15.18] - 2025-09-30

Fixes

[0.15.17] - 2025-09-24

Features

[0.15.16] - 2025-09-15

Performance

[0.15.15] - 2025-08-29

Fixes

[0.15.14] - 2025-08-12

Performance

[0.15.13] - 2025-07-09

Fixes

[0.15.12] - 2025-07-08

Performance

[0.15.11] - 2025-03-12

[0.14.3] - 2026-03-27

Added

Fixed

[0.14.2] - 2026-01-14

Added

Fixed

Changed

v6.4.0

What's Changed

New Contributors

v6.3.2

What's Changed

v6.3.1

What's Changed

New Contributors

6.4.1 - 2026-05-16

6.4.0 - 2026-01-02

6.3.2 - 2025-03-16

6.3.1 - 2025-02-09

6.3.0 - 2025-01-05

6.2.0 - 2024-10-26

6.1.0 - 2024-09-06

6.0.0 - 2024-07-20

0.39.0 (2026-01-25)

0.21.0 - 2026-05-18

Added

Changed

v0.13.2

tl;dr

What's Changed

New Contributors

v0.13.1

What's Changed

v0.13.0

Breaking changes

v0.13.2

v0.13.1

dependabot Bot commented on behalf of github Jun 6, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Jun 6, 2026 •

edited

Loading